NHS Synnovis data breach

In June 2024, criminal hackers stole patient data from Synnovis, a pathology provider serving several NHS hospitals and GP surgeries across south east London.

The data came from internal administrative working drives, rather than the main laboratory databases holding patient test requests and results. Because the stolen files were highly unstructured and incomplete, it took more than a year of forensic analysis by specialist teams to establish what had been taken, and which organisations and individuals were affected.

By November 2025, Synnovis completed its forensic review and began notifying affected NHS organisations. Under UK data protection law, the responsibility for notifying patients lies with the healthcare provider, the data controller, rather than Synnovis. Each affected NHS trust has been contacting its own patients as it completes its review.

Synnovis obtained a court injunction prohibiting third parties from accessing, sharing or misusing the stolen data. The incident has been investigated with the support of the National Crime Agency, NHS England and the National Cyber Security Centre, and has been reported to the Information Commissioner’s Office.

In June 2026, reports emerged that data linked to the breach had reportedly appeared on dark web marketplaces. These reports have not been independently verified in full and investigations remain ongoing.

What are your rights?

NHS organisations and their suppliers have a legal obligation to protect your personal data. Where a ransomware attack results in the theft and publication of patient data, affected individuals have the right to seek compensation – including for distress, anxiety and loss of control over their personal information.

You do not need to have suffered financial loss to make a claim. The sensitivity of the data involved, which may include health information and NHS numbers, and the distress caused by knowing your medical records have been accessed by criminals, are both recognised as grounds for a claim.

You can also raise a concern directly with the Information Commissioner’s Office independently of any compensation claim.

What data breach compensation could you receive?

There is no fixed amount. The value of a claim will depend on the individual circumstances of each person affected and what can be established about the safeguards in place at the time of the attack. Factors that are likely to be relevant include:

• Sensitivity of the data. This breach involves health-related data including test results and NHS numbers – among the most sensitive categories of personal information. Claims involving health data typically attract higher awards than those involving basic contact details alone.
• Distress and anxiety. Knowing that your medical records have been stolen by a criminal group and published online is a recognised form of non-material harm. The distress does not need to result in a diagnosed condition to form part of a claim.
• Risk of identity theft and fraud. NHS numbers, dates of birth and postcodes can be combined to facilitate identity fraud. Even where no confirmed misuse has occurred, the ongoing risk is relevant to the value of a claim.
• Risk of sensitive data being used against you. Cybersecurity experts have warned that medical records can be misused in targeted phishing attacks, social engineering or even attempts to extort individuals by threatening to disclose private health information.
• The length of time before notification. The attack occurred in June 2024. Many patients were not notified until late 2025 or 2026 – a period during which they were unable to take steps to protect themselves. This delay is likely to be relevant to individual claims.

Frequently asked questions